===================================================================
RCS file: /cvsrepo/anoncvs/cvs/www/74.html,v
retrieving revision 1.88
retrieving revision 1.89
diff -c -r1.88 -r1.89
*** www/74.html	2023/10/15 04:19:24	1.88
--- www/74.html	2023/10/15 10:45:56	1.89
***************
*** 667,681 ****
  	feature it helps enforcing control flow integrity by making sure
  	malicious code cannot manipulate a function's return address.
    </ul>
! 
! Together with retguard these features protect against ROP attacks.
! 
! Compiler defaults for base clang, ports clang and ports gcc (as well
  as some other non-C language family compilers in ports) have been
  changed to enable these features by default.  As a result the vast
  majority of programs on OpenBSD (and all programs in the base system)
! run with these security features enabled.
! 
    <ul>
    <li>Change <a href="https://man.openbsd.org/malloc.3">malloc(3)</a>
        chunk sizes to be fine grained: chunk sizes are closer to the
--- 667,679 ----
  	feature it helps enforcing control flow integrity by making sure
  	malicious code cannot manipulate a function's return address.
    </ul>
! <p>Together with retguard these features protect against ROP attacks.</p>
! <p>Compiler defaults for base clang, ports clang and ports gcc (as well
  as some other non-C language family compilers in ports) have been
  changed to enable these features by default.  As a result the vast
  majority of programs on OpenBSD (and all programs in the base system)
! run with these security features enabled.</p>
! <p><br>Further security enhancements in this release are:</p>
    <ul>
    <li>Change <a href="https://man.openbsd.org/malloc.3">malloc(3)</a>
        chunk sizes to be fine grained: chunk sizes are closer to the
***************
*** 688,697 ****
        administrators can now remove most users from the excessively
        powerful <code>operator</code> group, which in particular
        provides read access to disk device nodes.
!   <li>Restrict <a href="https://man.openbsd.org/patch.1">patch(1)</a>
!       to the current directory including subdirectories, TMPDIR,
!       and file names given on the command line using
!       <a href="https://man.openbsd.org/unveil.2">unveil(2)</a>.
    <li>In <a href="https://man.openbsd.org/ksh.1">ksh(1)</a>, consistently
        escape control characters when displaying file name completions,
        even when there are multiple matches.
--- 686,695 ----
        administrators can now remove most users from the excessively
        powerful <code>operator</code> group, which in particular
        provides read access to disk device nodes.
!   <li>Using <a href="https://man.openbsd.org/unveil.2">unveil(2)</a>,
! 	restrict <a href="https://man.openbsd.org/patch.1">patch(1)</a>
! 	filesystem access to the current directory including subdirectories,
! 	TMPDIR, and file names given on the command line.
    <li>In <a href="https://man.openbsd.org/ksh.1">ksh(1)</a>, consistently
        escape control characters when displaying file name completions,
        even when there are multiple matches.